Privacy Policy

1. Consent

The organisation will always obtain explicit consent from a data subject in order to collect and process their data, unless consent is not required in accordance with the law.

In the case of children under the age of 16 (a lower age may be allowed in specific countries), the consent of a parent or a legal guardian must be obtained.

While requesting for consent, AlgoBrains Solutions informs the data subjects about the organisation's identity, the nature and purpose of the processing, the list of personal data categories for processing, and explains the rights of individuals with regard to their personal data, including the right to withdraw consent. This information is provided in an intelligible and easily accessible form, using clear and plain language.

AlgoBrains Solutions requests separate consent for different purposes and types of processing, and does not use pre-ticked boxes or any other type of default consent in the consent requests.

2. Performance of a Contract

When the collected and processed personal data are required to fulfil contract with the data subject, explicit consent is not required. This will often be the case when the contract cannot be completed without the personal data in question e.g., a delivery cannot be made without an address to deliver to.

3. Legal Obligation

If the personal data is required to be collected and processed in order to comply with the law, then explicit consent is not required. This may be the case for some data related to employment and taxation for example, and for many areas addressed by the public sector.

4. Vital Interests of the Data Subject

In the case when the personal data are required to protect the vital interests of the data subject or another individual, then this necessity may be used as the legal basis of the processing. As an example, this case may be applied to the aspects of social care, particularly in the public sector.

5. Task Carried Out in the Public Interest

When the organisation needs to perform a task that is believed to be in the public interest or presents itself as a part of organisation's official duty then the data subject's consent will not be requested.

6. Legitimate Interests

If the result of data processing or specific personal data are a part of the legitimate interests of the organisation and are judged not to affect the rights and freedoms of the data subject in a significant way, then this may be defined as the legal reason for the processing. AlgoBrains Solutions performs a legitimate interest assessment (LIA) to ensure compliance with the principle of proportionality.

7. Conditions for Special Category Data Processing

1. Data Protection by Design and Default

The organisation adopts the principle of “data protection by design and default” and carries out appropriate technical and organisational measures to implement the data protection principles and safeguard individual rights.

In essence, “data protection by design” means that AlgoBrains Solutions has integrated data protection into systems, services, products and business practices, from the design stage right through the lifecycle. The organisation only uses data processors that provide sufficient guarantees of their technical and organisational measures for data protection by design. The organisation takes into account the data protection by design when it purchases products for use in its processing activities.

In fact, “data protection by default” means that AlgoBrains Solutions, in respect of its activities as a controller:

• specifies the minimum set of personal data required to achieve specific processing purposes before the processing starts;
• appropriately informs the data subjects;
• only processes the data necessary for processing purposes;
• does not process additional personal data until the data subject authorises to do so;
• ensures that personal data is not automatically available to others until the data subject allows it;
• ensures that personal data is automatically protected in any IT system, service, product and / or business practice, so that individuals should not have to take any specific actions to protect their privacy;
• offers strong privacy defaults, user-friendly options and controls, and respect user preferences. The organisation takes into account the use of techniques such as pseudonymisation where applicable and appropriate.

2. Contracts Involving the Personal Data Processing

AlgoBrains Solutions ensures that all relationships it enters into that involve the personal data processing are regulated by documented contracts that include the specific information and conditions required by the law.

Contracts of the organisation include the following compulsory information:

• specifies the minimum set of personal data required to achieve specific processing purposes before the processing starts;
• appropriately informs the data subjects;
• only processes the data necessary for processing purposes;
• does not process additional personal data until the data subject authorises to do so;

Contracts of the organisation include the following compulsory terms:

• the processor must only act on the written instructions of the controller (unless required by law to act without such instructions);
• the processor must ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• the processor must take appropriate measures to ensure the security of processing;
• the processor must only engage a sub-processor with the prior consent of the data controller and a written contract;
• the processor must assist the data controller to ensure that data subjects exercise their rights in accordance with the law of the data subject location country;
• the processor must assist the data controller in meeting its obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;
• the processor must delete or return all personal data to the controller as requested at the end of the contract;
• the processor should contribute to audits and inspections provide the controller with whatever information necessary to confirm the processors compliance with his obligations, and notify the controller immediately if it is asked to do something infringing data protection legislation.

AlgoBrains Solutions as a controller only appoints processors who can provide “sufficient guarantees” that the requirements of the law of the data subjects location countries will be observed, and the rights of data subjects will be protected.

3. International Transfers of Personal Data

AlgoBrains Solutions transfers personal data to the third country or the international organisation only if the requirements of the law of the data subjects’ location countries are fully observed, for example, if the transfer of personal data to that third country or international organisation is authorised by the regulatory body without additional authorisation by the supervisory authority, since there is an adequate level of protection that meets the requirements of the law, or if the organisation receiving the personal data has provided appropriate safeguards that comply with the requirements of the law.

Before such transfer AlgoBrains Solutions makes sure, that, as a result, the level of protection of data subjects ensured by law will not be undermined, including the cases of onward transfers of personal data from the third country or an international organisation to controllers, processors in the same or another third country or international organisation.

Following such transfer, individuals’ rights must be enforceable and effective legal remedies for individuals must be available.

4. Documenting Processing Activities

As a controller, AlgoBrains Solutions maintains records of the following categories to document its processing activities:

• records of processing activities;
• the legal basis for the processing;
• records of consent;
• legitimate Interests Assessment reports;
• information provided to data subjects;
• controller-processor contracts;
• the location of personal data;
• data Protection Impact Assessment reports;
• records of personal data breaches.

As a processor, AlgoBrains Solutions maintains records of the following categories to document its processing activities:

• records of processing activities;
• controller-processor contracts;
• the location of personal data;
• records of personal data breaches.

AlgoBrains Solutions’ undertakings employing fewer than 250 persons do not keep records of processing activities unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of personal data or personal data relating to criminal convictions and offences.

The records are kept in writing. The records are kept up to date and reflect current processing activities.

The organisation makes the records available to the supervisory authority upon request.

5. Implementing Appropriate Security Measures

AlgoBrains Solutions has identified and regularly updates the security threats to personal data, performs risk analysis related to the personal data processing, documents findings and uses them to assess the appropriate level of security that needs to be put in place.

The security threat to personal data means a factor that creates the danger of unauthorised, including accidental, processing of personal data, as well as the accidental or intentional loss, destruction or damage to personal data.

AlgoBrains Solutions has allocated responsibility for information security to certain employees and teams and provided them with the appropriate resources and authority. Employees who are authorized by the organization to process personal data, before starting to work with personal data, undertake responsibility to comply with confidentiality and other requirements of the Policy.

AlgoBrains Solutions’ undertakings have an information security rules and take the necessary steps to implement it. Where required, AlgoBrains Solutions’ undertakings adopt additional regulatory documents and ensure that controls are in place to enforce them.

AlgoBrains Solutions regularly reviews its information security regulatory documents and, if necessary, improves them. AlgoBrains Solutions conducts regular testing and reviews of its information security measures to ensure they remain effective, and act on the results of those tests where they highlight areas for improvement.

AlgoBrains Solutions’ undertakings keep records of assets involved in the personal data processing (applications, systems, personnel, and media).

AlgoBrains Solutions uses encryption and/or pseudonymisation, where it is appropriate to do so.

AlgoBrains Solutions’ undertakings mandatory use cryptographic security means if personal data is transmitted through open communication channels.

AlgoBrains Solutions’ undertakings have proper backup processes so that they can restore integrity and access to personal data in the event of any incidents, as soon as reasonably possible.

AlgoBrains Solutions’ undertakings make sure that any data processor they are using also implements appropriate technical and organizational measures.

AlgoBrains Solutions’ undertakings provide the necessary physical security measures to protect premises, equipment and information from unauthorized access.

AlgoBrains Solutions has defined business continuity arrangements that protect and recover any personal data the organization holds.

AlgoBrains Solutions conducts appropriate initial and refresher training for personnel involved in data processing on data protection issues and, including, inter alia, personal data processing duties, employees responsibility for personal data protection, rules and restrictions for employees to use the systems and services (for example, to avoid virus infection or spam).

6. Personal Data Breaches

The organisation has prepared a response plan for addressing any personal data breaches that may occur. AlgoBrains Solutions has allocated responsibility for managing breaches to certain employees and teams. The organisation’s employees know how to escalate a security incident to the proper responsible person or team in AlgoBrains Solutions to determine whether a breach has occurred.

AlgoBrains Solutions adopted a process to notify the supervisory authority of a breach within 72 hours after becoming aware of it, even if there are still no details. The organisation adopted a process to inform without undue delay the affected individuals about a breach, when it is likely to result in a high risk to their rights and freedoms. The organisation’s Data Protection Officers supervise the process of notifying the data subjects and supervisory authorities of the personal data breaches.

AlgoBrains Solutions documents all breaches, even if not all of them are in need to be reported.

7. Data Protection Impact Assessment (DPIA)

As a controller, AlgoBrains Solutions does a DPIA when personal data processing is likely to result in a high risk to individuals. The organisation considers expediency of fulfilment of a DPIA in any major project involving the personal data processing carried out as the controller. If AlgoBrains Solutions decides not to carry out a DPIA, it will document the reasons.

DPIA must:

• describe the nature, scope, context and purposes of the processing;
• assess the need for processing and proportionality to the purposes;
• identify and assess risks to individuals;
• identify any measures to mitigate those risks and to confirm compliance with legislation.

If the organisation identifies a high risk that it cannot mitigate, it should consult the supervisory authority before starting the processing.

8. Data Protection Officer (DPO)

AlgoBrains Solutions is not required to appoint a DPO, since it is not a public authority or body, does not perform large-scale monitoring, and does not process special categories of personal data on a large scale, but it has decided to do so voluntarily. The organisation understands that the same duties and responsibilities apply as with the mandatory appointment of DPO. AlgoBrains Solutions appoints the DPO at the head office and, if necessary, at some undertakings of the organisation.

AlgoBrains Solutions tasked its DPOs to monitor compliance with data protection laws and organisation’s data protection regulatory documents, awareness raising, employees training and the related audits. AlgoBrains Solutions timely involves its DPOs on all issues relating to the personal data protection.

The organisation’s DPOs inform and advise the employees of the organisation who carry out the personal data processing on their obligations under the data protection legislation.

The DPO of the head office reports directly to the top management of the organisation. The DPOs of other AlgoBrains Solutions’ undertakings cooperate with the DPO of the head office and report to the management of their enterprises and the top management of the organisation. All organisation’s DPOs are given the required independence to perform their tasks.

The organisation’s DPOs are easily accessible as the contact points for our employees, individuals and supervisory authorities. AlgoBrains Solutions published the contact details of its DPOs and communicated them to the supervisory authority.

9. Compliance with codes of conduct and certification systems

Professional associations and representative bodies may prepare codes of conduct covering topics such as fair and transparent processing, the legitimate interests pursued by controllers, pseudonymisation and the exercise of human rights, etc.

In addition, supervisory authorities or accredited certification bodies may issue certificates of compliance with the legislative requirements of data processing activities.

Compliance with the code of conduct and obtaining a certificate are voluntary, but the organisation sees them as an excellent way to monitor and demonstrate compliance with the requirements for the personal data protection.